Universal Squash Model For Optical Communications Using Linear Optics And 

Threshold Detectors 
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The transmission of photons through open-air or an optical fiber is an important primitive in quan- 
tum information processing. Theoretical description of such a transmission process often considers 
only a single photon as the information carrier and thus fails to accurately describe experimental op- 
tical implementations where any number of photons may enter a detector. It is important to bridge 
this big gap between experimental implementations and the theoretical description. One powerful 
method that emerges from recent efforts to achieve this goal is to consider a squash model that con- 
ceptually converts multi-photon states to single-photon states, thereby justifying the equivalence 
between theory and experiments. However, up to now, only a limited number of protocols admit a 
squash model; furthermore, a no-go theorem has been proven which appears to rule out the existence 
of a universal squash model. Here, we observe that an apparently necessary condition demanded 
by all existing squash models to preserve measurement statistics is too stringent a requirement for 
many protocols. By chopping this requirement, we show that rather surprisingly, a universal squash 
model actually exists for a wide range of protocols including quantum key distribution protocols, 
quantum state tomography, the testing of Bell's inequalities, and entanglement verification, despite 
the standard no-go theorem. 

PACS numbers: 03.67.Dd, 02.50.Tt, 03.65.Ta, 42.50.Ex 



I. INTRODUCTION 

Quantum mechanics opens up new ways to process in- 
formation. Quantum information processing (QIP) al- 
lows tasks not possible in classical information process- 
ing, such as non-local correlations [l],[2[,and uncondition- 
ally secure schemes for cryptography [3|-|5(, randomness 
generation Q , and data hiding [J Q . One of the great- 
est triumphs of QIP to date is quantum key distribution 
(QKD) (a.k.a. quantum cryptography), which allows two 
distant users to share a secret (as a classical bit string) 
by sending quantum states over a quantum channel. Due 
to the ease of generation, transmission, and detection, 
photons are often used as information carrier in many 
quantum communication Q tasks inclu ding Q KD (see, 
e.g., doHHI), teleportation (see, e.g., 13l4l6l|). super- 
dense coding (see, e.g., [TZrUJi), and quantum networks 
(see, e.g., U$M)- 

In many quantum communication schemes (such as the 
most well-known QKD protocol - the Bennett-Brassard- 
1984 protocol [|| - and quantum state tomography [2^|). 
the analyses often work on the assumption that the 
quantum channel presents single-photon signals to a re- 
ceiver. These signals are subsequently measured with 
single-photon measurements. However, in practice, ex- 



perimental equipment fall short in guaranteeing such a 
pure single-photon environment. This is because prac- 
tical photon sources occasionally emit more than one 
photon, and the detection setup for implementing the 
qubit measurement is usually composed of threshold de- 
tectors (such as standard InGaAs or silicon avalanche 
photo-diodes). Threshold detectors only produce a click 
if the input signal contains one or more photons; thus, 
they are incapable of revealing the number of photons 
entering the detection setup. This immediately raises a 
key question: does this mean that all singlc-photon-based 
quantum communication schemes cannot run as expected 
from their original design and analyses? For example, 
it is unclear whether a single-photon-based QKD proto- 
col can still provide unconditional security when multi- 
photon signals are received from the quantum channel. 
Also, in quantum state tomography, it is unclear whether 
we can ascribe a single-photon description to a state that 
we measure when such a state comes from a source that 
occasionally emits multi-photon signals. 
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The problem was initially motivated by QKD |23H25f , 
but was realized to be important in other QIP tasks such 
as entanglement verification [2|| [26J. This is because 
many QIP tasks also rely on qubits as the basis of analy- 
sis but they do not carry the immediate security concern 
of QKD that an intelligent eavesdropper may meticu- 
lously align her strategy with the practical detectors' be- 
haviour. Our goal is to bridge the idealization of qubit- 
bascd quantum communications and the physical real- 
ization where multi-photon signals may be emitted from 
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the source and/or received from the quantum channel. 
Indeed, the significance of this gap was demonstrated by 
Semenov and Vogel [13] who showed that the mismatch 
between the theoretical single-photon consideration and 
the actual experimental reality with multi-photon signals 
might produce a fake violation of Bell's inequality and 
even quantum physics (28[. 

While we address this QKD-motivated problem in the 
QKD context, our discussion applies equally to other 
contexts including quantum state tomography. Indeed, 
later in the paper, we will show that quantum state 
tomography technique can be also be applied to a de- 
tection setup with threshold detectors. Also, we note 
that there is a deep connection between the security 
of QKD and the testing of Bell's inequality which was 
first mentioned by Ekert [|[ in 1991 and was subse- 
quently demonstrated through the idea of "self-testing" 
for QKD [29|, [30|. d evice- independent QKD based on 
Bell's inequality [31^321], and state tomography based 



on Bell's inequality 33| . 

QKD can be either preparc-and-mcasurc or 
entanglement-based. In the former, one party Al- 
ice prepares a quantum state and sends it to another 
party Bob who immediately measures it upon reception, 
and in the latter, an entanglement source generates a 
pair of entangled quantum states to be distributed to 
the two parties. The multi-photon problem arises on 
the source side for preparc-and-measure QKD protocols 
because a phase-randomized weak coherent source is 
often used to simulate a single-photon source. Since the 
multiple photons in an emitted signal are modulated to 
carry the same information, extra copies of quantum 
information is available to Eve. The multi-photon 
problem on the receiver side arises from the use of 
threshold detectors in both type of QKD schemes. 

Existing efforts in setting up actual QKD experi- 
ments involving threshold detectors and multiple-photon 
sources as well as in proving the unconditional security 
of QKD schemes using ideal apparatus [3^ - l38j will not 
be wasted if one can slightly modify the post-processing 
procedure, the security proof, or the existing experimen- 
tal setup using currently available technologies. Along 
this line of thought, the multi-photon problem at the 
source (for prepare-and-measure schemes) was solved by 
Gottesman, Lo, Liitkenhaus, and Preskill (GLLP) [23[ 
with great performance enhancement from using decoy 
states jHEl (sec also Ref. [H). 

On the other hand, the threshold detection prob- 
lem at the receiver (for both prepare-and-measure and 
entanglement-based schemes) can be solved by concep- 
tually assuming a quantum operation before Bob that 
maps Eve's multi-photon states to sin gle-p hoton states. 
GLLP called this a squash operation |23[ (see Fig. [TJ). 
If an actual squashing device were concatenated to the 
multi-photon quantum channel, we would have an effec- 
tive single-photon quantum channel emitting only sin- 
gle photons. Such a physical squashing device would 
immediately make the receiving side of the experimcn- 
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FIG. 1. The squash operation is a valid quantum operation 
that maps a multi-photon input state to a single-photon out- 
put state. The practical source together with the squash oper- 
ation can be regarded as a single-photon source. The practical 
measurement on the multi-photon signal consists of threshold 
detectors and is argued in this paper to be statistically re- 
lated to the combination of a universal squash operation and 
an ideal qubit measurement. Here, for simplicity, we use pho- 
ton sources to also mean quantum channels. 



tal setup compatible with the single-photon-based anal- 
yses. Although such a squashing device is impractical, 
the squashing approach can still be used to justify the 
conceptual presence of a squashing device, which is not 
always possible. Actually, the squash operation was fully 
justified only in a few securi ty p roofs for the BB84 [24H25| 
and the BBM92 protocols [24[. These squash-operation- 
based security proofs are rather specific and do not pro- 
vide a universal way to translate Eve's attack that out- 
puts a multi-photon state to an attack that outputs 
a single-photon state. In particular, a squash map is 
proved to not exist for the six-state QKD scheme with ac- 
tive basis selection |25l] which is a scheme first introduced 
by Bennett et al. |43| and later by Brufi [44| . In summary, 
previous works [45j show that a universal squash does not 
exist. This is a highly disappointing result because it ap- 
pears to mean that for each protocol, one has to prove its 
security by a different method because one cannot apply 
a universal squash operation. 

Despite the previous no-go theorem, here we show that 
a universal squash actually exists. The previous no- 
go theorem rests on a rather strong assumption that a 
squash map must be able to reproduce the precise mea- 
surement statistics (e.g., error rates). Preserving the 
statistics is a rather stringent requirement. The suc- 
cess of our approach lies in that we do not attempt to 
reproduce the exact statistics of the conceptual squash 
situation and we recognize that most quantum proto- 
cols do not need knowledge of exact statistics to func- 
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tion (bounds on statistics also suffice). Indeed, by relax- 
ing this requirement and allowing a universal squash to 
produce only bounds on statistics, we show that, rather 
surprisingly, a universal squash actually exists. Con- 
sequently, many security proofs for single-photon QKD 
protocols (with active or passive basis selection) includ- 
ing the six-state protocol [44j , three-states protocols (4(| , 
the SARG04 protocol (with four or six states) [47l | , the TV- 
basis protocol , and protocols using decoy states f3Sj— 
l4lj . multi-partite quantum cryptographic protocols [49| . 
reference- frame independent QKD [50(, two-way proto- 
cols j5l| directly carry over to practical implementations 
with a weak-coherent-state source and threshold detec- 
tors. This amounts to immense simplification. We em- 
phasize that, in addition to QKD, our work also applies 
to quantum state tomography, the testing of Bell's in- 
equalities, and entanglement verification. Later in this 
paper, we will discuss the application of our universal 
squash model to quantum state tomography and the test- 
ing of Bell's inequalities. Here, we remark that while the 
protocol-specific squashing approach of Ref . 1251 has also 
been applied to entanglement verification |26f . our ap- 
proach has the advantage of being protocol independent 
(i.e., universal) and being applicable in many different 
contexts including quantum state tomography. 

The organization of our paper is as follows. We discuss 
our proof on universal squash model in Sec. [TT] followed 
by a discussion on the special treatment for the key bits 
in QKD in Sec. IIIII We then apply our universal squash 
model to QKD protocols in Sec. HV| quantum state to- 
mography in Sec. [V] and the testing of Bell's inequality 
in Sec. ED We conclude in Sec. EH 



II. UNIVERSAL SQUASH MODEL 

We discuss our result assuming the following settings: 

• The incoming photons are restricted to a single op- 
tical spatio-temporal mode and information is en- 
coding in polarization. Note that there is no loss of 
generality in our discussion because phase encoding 
is mathematically equivalent to polarization encod- 
ing. 

• For simplicity, we assume that Bob uses active basis 
selection for his measurements so that his detection 
system projects the incoming signal onto the eigen- 
states of only one basis. (We extend it to the case 
of passive basis selection in Appendix [C]) 

• Bob's detection system consists of two threshold de- 
tectors plus possibly other linear optical elements 
(a representative structure is shown in Fig. [5]). All 
photons in the same spatio-temporal mode enter- 
ing each detector will be measured and collapsed 
individually. In other words, the projection oper- 
ators describing the measurement of each individ- 
ual photon commute and are independent of each 
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FIG. 2. Detection system used by Bob for one basis, where a 
set of waveplates (WP) select the basis and a polarizing beam- 
splitter (PBS) splits the signal into two arms for detection by 
two threshold detectors (DO and Dl). Here, the incoming sig- 
nal consists of three photons and one is (two are) collapsed in 
detector DO (Dl). 



other. Even though we focus on a two-detector re- 
ceiver, for simplicity of discussion, our proof works 
with any number of detectors where multiple clicks 
may occur. 

• The threshold detectors have perfect efficiencies 
and no dark counts. Therefore, all incoming pho- 
tons arc collapsed. Inefficient detectors may be 
modeled as perfectly efficient detectors followed by 
a beamsplitter, which may be absorbed into the 
channel. 

• Quantum non-demolition (QND) measurements 
are implicitly assumed, without loss of generality, 
to be used by Bob to determine the input photon 
number throughout the proof. The presence of the 
QND measurements is consistent with the thresh- 
old detector model and does not affect the func- 
tioning of it. 

Our proof can be illustrated pictorially as shown in 
Fig. [3] The essence is to link the real situation (with 
threshold detectors and the possibility of double-click 
events) to an ideal situation (consisting of a universal 
squash operation), which are Situation 3 and Situation 
1, respectively, in Fig. [3J This linking is established by 
regarding the two situations as statistically equivalent 
to special cases of classical post-processing for a detec- 
tion setup with photon-number-resolving (PNR) detec- 
tors (Situations 2 and 4). Both Situations 2 and 4 can 
be derived from Situation 5, which is a detection setup 
with PNR detectors that outputs the full information on 
the number of photons detected in each detector. We 
discuss the elements of our proof as follows. 



A. State representation 

We write an n-photon pure state in tensor product 
form and then impose bosonic symmetry by symmetriz- 
ing the state [52j . Similarly, an n-photon mixed state can 
be dealt with as a mixture of pure states. Let p denote 
the density matrix of an n-photon state. A squash opera- 
tion is a quantum operation that takes an n-photon state 
as input and produces a single-photon state as output. 
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FIG. 3. Relationship map for the five situations used to prove our universal squash model. The goal is to link the real situation 
(Situation 3) with the ideal situation (Situation 1) consisting of the universal squash operation. 

In Situation 1 (a virtual protocol), an n-photon state enters a detection system comprising the squash operation A re _>i, a set of 
waveplates (acting as unitary transform U), a polarizing beamsplitter, and two detectors. The universal squash operation A n _>i 
maps n photons to one. We do not specify whether the detectors are photon-number-resolving (PNR) or threshold detectors 
since after the squash operation, only one photon remains. The output of the detection system is a bit value corresponding to 
the detector that has a click. This is a single-qubit situation since we can regard the squash operation as part of the channel. In 
Situation 2 (a virtual protocol), an n-photon state enters a detection system comprising a set of waveplates (acting as unitary 
transform U® n ), a polarizing beamsplitter, and two PNR detectors, followed by a classical post-processor. The classical post- 
processor serves as the classical analog of the squash operation A„-n and outputs a bit value according to probabilities given 
by the detectors' clicks. More concretely, suppose that detectors DO and Dl register fco and k\ photons respectively. Then, the 
classical post-processor in Situation 2 outputs event "bit i" (i = 0, 1) with probability ki/(ko + ki). 

We show in Theorem [T] that the bit value outputs of Situations 1 and 2 have the same statistics for any n-photon input state 
and any unitary transform U (see Supplementary Materials for proof). 

Situation 3 (the real protocol) is the similar to Situation 2 with the PNR detectors replaced by threshold detectors. Situation 
3 outputs event "bit i" if only detector Di clicks (i — 0, 1) and event "double-click" if both detectors click. Situation 4 is 
also similar to Situation 2 with a difference in the post-processing part. Here, the post-processing only announces one of three 
events corresponding to a single-click for "0", a single-click for "1", and a double-click. It is easy to see that the Situations 3 
and 4 produce the same output statistics for the same input state. In this paper, we consider only those protocols for which 
Situations 3 and 4 are equivalent. 

Situation 5 is the mother protocol that derives Situations 2 and 4. Note that the detection parts of Situations 2,4, and 5 are 
all the same; only their classical processing parts are different. In fact, the classical processing parts of Situations 2 and 4 can 
be generated by that of Situation 5 which outputs the full information on the numbers of detection clicks. 
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B. Universal squash operation 

We define our universal squash operation as the map- 
ping from p to p qu bit where p qu bit = Tr(p) over any n— 1 
photons is the reduced density matrix of one photon. It 
does not matter which n — 1 photons we trace over and 
the same p qu bit will result due to the bosonic symmetry. 
We denote this mapping as A n ^i(p) — p qu bit- Note that 
A, w i is a valid quantum operation. 



C. Equivalence of Situations 1 and 2 

Theorem 1. Situations 1 and 2 are equivalent and pro- 
duce the same output statistics for any unitary transform 
and any n-qubit input state. 

This result is non-trivial and its proof is discussed in 
Appendices IA II and IA 21 The main point is that a uni- 
versal squash operation (Situation 1) can be regarded as 
a special classical post-processing method for a detection 
system with PNR detectors (Situation 2). Theorem [T] 
justifies an effective single-qubit channel since the squash 
operation in Situation 1 can be regarded as part of the 
channel. This means that it is valid to apply the result 
of any single-qubit-based analysis to Situation 2. 



Specifically, a double-click event contributes as an error 
bit for the calculation of the upper bound on the error 
rate and contributes as a correct bit for the lower bound. 
Suppose that the number of test bits for basis b is Nb, 



where N b 



AT 



Ni + Ni. Here, NT 



N*' c , and N 



are the correct single-click events, erroneous single-click 
events, and double-click events, respectively. Then, the 
error rate of the test bits is bounded by 



<e b < 



n? 



(1) 



Corollary 1. (Single-qubit description) We regard the 
original quantum channel followed by the squash oper- 
ation A n _>i in Situation 1 as the effective single-qubit 
quantum channel. Thus, we can ascribe a single-qubit 
description to the actual received signals and the associ- 
ated channel error statistics are bounded by Eq. ((T|). 

This allows us to apply any single-qubit-based security 
analysis to qubit-based QKD protocols whose qubit as- 
sumption is violated in practical implementation due to 
the reception of multi-photons. 

Note that there are two such effective single-qubit 
quantum channels for entanglement-based QKD proto- 
cols (in which an entanglement source sends two signals 
one to Bob and one to Alice). 



D. Equivalence of Situations 3 and 4 

It is easy to see that the real situation with threshold 
detectors (Situation 3) is equivalent to another special 
classical post-processing method for a detection system 
with PNR detectors (Situation 4). 

E. Relationship between Situations 2 and 4 

Situations 2 and 4 are related through Situation 5 
(shown in Fig. [3]) . Since both Situations 2 and 4 are spe- 
cial cases of classical post-processing for a detection sys- 
tem with PNR detectors, they can both be derived from 
the same situation - Situation 5. Thus, the statistics of 
Situation 4 can be used to infer some statistics about Sit- 
uation 2. For QKD protocols, the statistics of interest is 
the error rate e b between Alice and Bob in basis b. Thus, 
we aim at providing bounds on the error rates. A single- 
click in Situation 4 immediately tells us that a definite bit 
value would have been obtained in Situation 2 and this 
bit value is directly used for the evaluation of the error 
rates. On the other hand, a double-click in Situation 4 
does not tell us which bit value it corresponds to in Sit- 
uation 2, and there is no definite bit value to be used for 
the error-rate evaluation. To overcome this, we recognize 
that we do not need to know the definite bit value since all 
we care are bounds on the error rates. Our key idea is to 
bound the range of possible error rates by using the most 
pessimistic and optimistic values for double-click events. 



III. POST-SELECTION OF KEY BITS IN QKD 

In QKD protocols, one subset of the data obtained 
from the quantum channel (called the test bits) is de- 
voted to estimating the statistics of the channel and an- 
other subset (called the key bits) for key generation. The 
key bits are eventually transformed into the final secret 
key through a series of classical operations and commu- 
nications. 

The bounds established above given in Eq. ([1]) apply to 
the channel output states irrespective of whether they are 
used as test bits or key bits. Since we actually need to use 
the bit values of the key bits, we propose to discard all the 
double-click key bits for which we do not know the values. 
This post-selection procedure requires us to extend the 
bounds of Eq. (JTJ) when applied to the remaining key bits 
since we need to take into account the most pessimistic 
and optimistic error statistics of the discarded bits 

More specifically, if we had known the value of every 
key bit in Situation 2, we would have directly applied 
a qubit-based security proof to distill a final secret key. 
However, we are in Situation 4 (or Situation 3, the real 
situation), and we do not know the key bit value for 
double-click events. To solve this problem, our strategy 
is to discard all double-click key bits and augment the 
error rate bounds of Eq. ((T|) for describing the remaining 
key bits. Eventually, we will come up with new bounds 
for the error rates for the key after discarding: 

e kcy,L < g kcy < ^cyV ^ 
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To aid discussion, we designate one basis as the key- 
generating basis, denoted as basis b*. All key bits are 
detected in this basis and thus all single- or double-click 
events arc classified according to this basis. We first con- 
sider the 6-basis error rate, where b ^ b* . Because the key 
bits discarded according to whether it is a double-click 
event in the b* -basis may have any error rate in other 
bases, the lower and upper bounds on the error rate e^ ey 
in the 6-basis for the remaining key bits are: 



= kcy,L 



kcy,U 



key 



N gy,t 



N^ y > 1 



^ykcy,s ' 



(3) 



for b ^ b* 



where N^° y ' s (N^° y ' d ) is the number of single-click 
(double-click) events among all the N t 



key 



N, 



key,! 



N^ y ' d key bits measured in basis b*. Here, the lower 
(upper) bound comes from assuming that the 6*-basis 
double-click events discarded correspond to erroneous 
(correct) bits in the 6-basis. 

The b* -basis error rate of the key bits after discarding 
double clicks can be inferred from the 6*-basis error rate 
of the single-click test bits. In the asymptotic case, these 
two error rates are the same, and are given by excluding 
the double-click events in Eq. (TTJ: 



P ke y 

e 6* 



AC 



N s b f 



(4) 



Eqs. ©-(HI) describe the key bits measured in the 
&*-basis after discarding double-click events. Classical 
post-processing steps derived from a qubit-bascd secu- 
rity proof can then be used to distill a final secret from 
the key bits according to these equations. Also, we only 
need to consider physical states that satisfy the error rate 
constraints given in Eqs. ©-Q; unphysical states need 
not be considered. 

The key distillation steps arc usually composed of two 
parts: error correction (EC) and privacy amplification 
(PA). EC and PA are classical procedures for correcting 
errors between Alice's and Bob's initial keys and for re- 
moving Eve's information about their keys, respectively. 
The codes/schemes and the associated parameters for EC 
and PA are determined from Eqs. ©-(IIJ according to the 
security proof for the particular QKD protocol. 



according to the worst-case error rates automatically tol- 
erate intermediate error rates. 

Note that correlation between the different bases, 
which are reflected in the error rates and the structure of 
their respective bases (e.g., as in the six-state protocol), 
can be exploited by choosing the EC code and the PA 
scheme appropriately. To compute the asymptotic key 
generation rate, it is sufficient to consider the worst-case 
physical state (see examples in Sec. II V[) . 



IV. QKD EXAMPLES 

A. Six-state QKD protocol 

Considering the asymptotic case, suppose that Alice 
and Bob observe that their measurement results on the 
test bits for bases X, Y, and Z all have the same erro- 
neous single-click rate e, double-click rate 6, and correct 
single-click rate 1 — 5 — e. |53j This induces the follow- 
ing bounds on the asymptotic error probabilities on the 
key bits (before discarding double-clicks) according to 
Eq. ©: 



e < ex,e Y ,ez <e + S. 



(5) 



The key bits are measured in the Z-basis and double-click 
key bits are discarded. After discarding, the error rate 
in the Z-basis of the post-selected key bits is given by 
Eq. (0J due to direct inference from the test bits and the 
error rates in the other bases are bounded with Eq. ([3]): 



key 

e 7 = 



1 



(6) 



< 



1-5' 



The key generation rate for the six-state protocol with 
one-way error reconciliation is (cf . Ref . [54| ) : 



min (1 — 5) 

61,62,63 



1 - hi &i,& 2 ,&3, 1 - y^bj 



(7) 



subject to e^ ey 



bi+b 2 , e^ y 



62 + b 3 , e-v =bi+ 63, 
and Eq. ((6]), where h(bi, 62, • • •) = -X^M°g&v Tnc 
minimum is achieved with, under some condition, (sec 
Appendix [B]) 



A. QKD post-processing with error-rate ranges 

We emphasize that our method involves EC and PA 
that operate on error rates given in ranges where the 
lower bound is not necessarily zero. Note that most real- 
istic EC codes are already designed to correct errors up to 
a certain error rate starting from zero. Also, PA schemes 
based on phase error correction using random hashing or 
random codes [33436} and those based on information- 
theoretic proofs using universal hashing [37], H|| chosen 



bi = 
bs = 
b 2 = 



-b 2 



-r-b 2 



1 - 6 
e-25 



(8) 
(9) 
(10) 



Note that in the limit that 5 goes to zero, 61 = 62 = 
63, and we recover the standard result in singlc-photon- 
based six-state QKD. This shows that at small double- 
click rates, the six-state protocol still gives a higher key 
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rate than the BB84 protocol [55|. In practice, the double- 
click rate with a weak-coherent-state source is usually 
pretty small, since the average source intensity is usually 
less than one photon per pulse and the fiber medium 
incurs signal loss. Thus, applying our universal squash 
model to the six-state protocol in practice does not incur 
much loss due to the pessimistic error-rate estimation and 
the discarding of double-click key bits. This shows the 
power of our universal squash model in security proofs. 



B. The BB84 protocol 

Similar to the example on the six-state protocol, sup- 
pose that Alice and Bob observe that their measurement 
results on the test bits for bases X, Y, and Z all have 
the same erroneous single-click rate e, double-click rate 
5, and correct single-click rate 1 — 5 — e. This induces the 
following bounds on the asymptotic error probabilities: 



e < ex, ez < e + 5. 



(11) 



The key bits are measured in the Z-basis and double- 
click key bits are discarded. After discarding, the error 
rate in the Z-basis of the post-selected key bits is e due 
to direct inference from the test bits (cf. Eq. |QJ) and 
the error rate in the X-basis is bounded with Eq. ©: 



key 



1-5 



< 4 ey < e 



(12) 



1 



The key generation rate with one-way reconciliation is 

thus HE m, HI m 
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FIG. 4. Dependence of the key rate R per detected signal on 
the double-click rate 8. The solid curves are for our univer- 
sal squash model (Eq. (|13[) 1 and the dotted curves and the 
dashed curves are for the BB84-specific squash model [24I I2EI ] 
(Eq. lfT4]) and Eq. ([To) respectively). 



Here, the first entropic term corresponds to bit error cor- 
rection and the bit error rate is obtained with Eq. 
the second entropic term corresponds to phase error cor- 
rection and the phase error rate is upper bounded by as- 
suming that all the double-click key bits discarded have 
no phase error and re-normalizing the phase error rate of 
the initial set of key bits e + | by the size of the final set. 
Figure U compares the two models, and it shows that 
substantive difference exists between i?BB84 an d ^bb84 
when the double-click rate is large. However, in practice, 
the double-click rate is usually quite small. 



-RBB84 = (1 — 5) 



-ho 



e + 5 



(13) 



The squash model of Ref. [2J, |25j for the BB84 proto- 
col preserve the measurement statistics when the double- 
click events are randomly assigned a bit value. Their key 
rate without discarding double-click events is 



BB84 



l-2/io 



■5/2). 



(14) 



Figure [4] shows that our universal squash model given 
in Eq. (|13[) has similar performance as or even some- 
times outperforms the statistics-preserving squash model 
of Ref. [13, HH given in Eq. (|T4|) . This is because we al- 
low double-click key bits to be discarded in our model. 
For fair comparison, we also consider the key rate of 
the statistics-preserving squash model with discarding 
double-click key bits: 



BB84 



(1-5) 



-h 2 




(15) 



C. BB84 in realistic setting 



We consider the performance of our universal squash 
model in the realistic setting with a weak coherent state 
source and the decoy-state method. Suppose that Alice 
uses a phase-randomized weak-coherent-state source that 
emits signals of photon number n with the Poisson dis- 
tributed probability p^.n = - where /1 is the mean 
photon number. Typically, /1 is small and on the order 
of 1 (e.g., jU = 0.5). The yield, Y n , is the probability 
that Bob gets a detection (either a single-click event or 
a double-click event) given that Alice sent an n-photon 
signal. For a state generated by the source with inten- 
sity n, the gain, defined as the probability that Bob has 
a detection and Alice sent an n-photon state, is 
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(16) 
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FIG. 5. Dependence of the key rate per transmitted signal on 
distance. The solid curves are for our universal squash model 
(Eqs. ([231) and ([25}) and the dashed curves are for the BB84- 
specific squash model H3, Hf| (Eqs. ([27} and ([25}). Optimal 
[i is used at every distance. Here, we used the experimen- 
tal parameters for signals at wavelength 1550 nm from the 
Gobby- Yuan-Shields experiments [57[: ol = 0.21 dB/km and 
?7Bob = 4.5% . 



The overall gain, single-click error rate, single-click cor- 
rect rate, and double-click rate, are, respectively 



n=0 

oo 

QfJ-F^' = ^ ^ Vji.nXnFn 
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where 



x 11 1 x r» 



F„ d = l 
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(17) 
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(20) 

(21) 



and the three terms in the last equation are the single- 
click error rate, single-click correct rate, and double-click 
rate on n,-photon states sent by Alice. 

To estimate the chann el p arameters, we use the infi- 
nite decoy state protocol [40[ in which we vary the source 
intensity /x continuously to generate infinitely many de- 
coy states that form a system of linear equations from 
Eqs. (fTT)) - (f2"0")) . We expect that a finite decoy state 
method will give similar results |U [H| . The decoy states 
are solely for parameter estimation, and solving this sys- 
tem of equations gives Y n , F*' e , F*' c , and F„ for all n. 
Since we now know the single-click error rate, single-click 
correct rate, and double-click rate for the single-photon 
states emitted by Alice, we can compute the worst-case 
single-photon error rates in our universal squash model 
in the same manner as in the previous analysis for single- 
photon sources. According to Eq. JT]), they are bounded 
by 



<e XA ,e ZA <F*> e + F?. 



(22) 



The key bits are measured in the Z-basis and double- 
click key bits are discarded. After discarding, the single- 
photon error rate in the A-basis is bounded as in Eq. §S§ 
to be 



= key 



< 



1-Ff 



F l _ kcy,U 

id _ e x,i ■ 



(23) 



Since we correct all Z-basis errors for all states with any 
photon number, the overall error rate in the iT-basis of 
the post-selected key bits is given by Eq. @ to be 



B key 
■-Z,p, 



Fr, 



(24) 



Here, we use /2 to represent the intensity for the key- 
generating signal states. The key rate, according to 
Gottcsman-Lo-Lutkcnhaus-Prcskill [23, is 



-RBB84, decoy — — Qp.(^ — F^)Il2 

Q fi ,i(l-F?) [i 



3 key\ 
■Z,fi) 



(4T)]- (25) 



9 



s,e 
n ! 



We assume the following simulation model to rcpre 
sent Eve's control over the channel parameters, Y n , 
F^' c , and Each photon has a certain transmission 
probability r/ c h = 10 _ t° of not being lost in the fiber op- 
tic channel where a in dB/km is the loss coefficient of 
the fiber and I in km is the length of the fiber. Also, 
Bob's detectors have a certain detection efficiency ?7Bob 
for detecting an input photon. Thus, the probability for 
a single photon to be detected by Bob is 77 = rfch^Bob- 
The yield is 



Y, 



1 - (1 - rf) n . 



(26) 



Since we do not assume the detectors to have dark counts, 
a single-photon signal emitted by Alice will at most pro- 
duce one click on Bob's side if the signal goes through 
a passive channel. Thus, for illustration purpose, we 
assume that Eve actively introduces multiple photons 
to Bob and her attack induces F*' e = e, F d = S, and 
i 7 !^ = f — e — 6 for all n. Figure [5] shows the key gen- 
eration rates using this simulation model. Results for 
our universal squash model and the statistics-preserving 
squash model of Ref. 0, [H[ specific to BB84 are shown. 
The key rate for the latter case is given by Eq. (f2"5|) with 



3 koy,U _ 
-A",l " 



Ft/2 



1 -F^ 



(27) 



As shown in the figure, the performance degradation of 
our universal squash model is small when the single-click 
error rate e is small or the double-click rate 8 is small. 
Note that there is no cutoff distance for both cases since 
we do not assume the detectors to have dark counts. 



V. QUBIT STATE TOMOGRAPHY 

In many qubit state tomography experiments (e.g., 
[59l l60j). photons often are not generated from true 
single-photon sources. When non-ideal sources and 
threshold detectors are used, without a squash model it 
is unclear whether one can talk about determining the 
qubit state since multi-photon signals may be emitted. 
On the other hand, our universal squash approach allows 
quantum state tomography techniques to be rigorously 
applied even to detection setups with non-ideal sources 
and threshold detectors. After a squash operation, a 
state is reduced to that of a qubit and one can deter- 
mine tomographically the state of the resulting qubit. 
We emphasized that our universal squash model can also 
be applied to multi-qubit tomography |6lj . The overall 
argument for applying our universal squash model to to- 
mography is similar to that for QKD, with a difference 
in the statistics of interest involved. Here, as shown be- 
low, we are interested in the average measurement value 
instead of the error rate. Standard qubit state tomog- 
raphy using the Stokes parameters [62j involves mea- 
suring the polarization of identical single-photon states 
p in an ensemble using the three bases X, Y , and Z. 



The Pauli matrices arc W = \0w)(0w\ — |lw)(lw| 
where W = X,Y,Z, and \b x ) = (|0 Z ) + (-1 ) 6 |l z ))A/2, 
\b Y ) = (\0z) + (-l) b i\lz))/V2, b= 0,1. The density ma- 
trix of the qubit p can be tomographically determined to 
be 



1 



E 

W=X,Y,Z 



Tr(pW)W. 



(28) 



We now discuss how to bound the parameters Tv(pW) 
when non-ideal sources and threshold detectors are used. 
Suppose that we measure basis W with a threshold de- 
tection setup in Fig. [5] for Nw number of signals. Ac- 
cording to the measurement outcomes, we decompose the 



V 



N w where 



signals into three parts: Nw — ~r- L, w 
N w and N w are the single-click events corresponding to 
the ±1 outcome of the measurement W and double-click 
events, respectively. Then, Tr(pW) is bounded by 



N s,+ _ N s- 



N d 



N w 



< Tr(pVV) 



< 



N s ' + 



X 



w 



(29) 
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Using these bounds and Ti(pl) = 1, we can obtain a 
set of consistent qubit states using Eq. (|28p. Essentially, 
our universal squash model allows one to ascribe a qubit 
description to the output states. 



VI. TESTING OF BELL'S INEQUALITY 

We can use our result to derive bounds on Bell's in- 
equality [l[ violation which may subsequently be used for 
qubit state tomography. Here, the statistics of interest 
comes from the Clauser-Hornc-Shimony-Holt (CHSH) in- 
equality Q (perhaps the most famous Bell-type inequal- 
ity [l[) which considers the statistics \ = E[AiBi] + 
E[A 1 B 2 }+E[A 2 B 1 \-E[A2B 2 }, where E[AiBj} = {i>\Ai® 
Bj\tjj) is the expectation value of the bipartite state \4>) 
with { — 1, +l}-valucd obscrvablcs Aj, Bj, i,j — 1, 2. The 
maximum value of x in quantum mechanics is 2y/2 which 
can be achieved by a maximally entangled state, while 
the maximum value of x f° r states consistent with local 
hidden variable (LHV) models is 2. Thus, any experi- 
ment showing a violation of x > 2 will rule out LHV 
theories. However, so far, no conclusive experimental vi- 
olation (6314731 exists due to the difficulties in closing the 
locality, detection, and postselection loopholes. 

It should be emphasized that for the purpose of ruling 
out LHV theories, any such experiments do not have to 
assume quantum mechanics to hold, let alone a quantum 
channel that emits qubit signals. In this case, when a 
double-click event occurs, one may apply any bit assign- 
ment scheme (such as a random bit assignment scheme) 
to this event without regard to the question of compati- 
bility with any qubit squash model. On the other hand, 
our universal squash model becomes relevant when the 



10 



CHSH violation is used in a quantum context. We may 
consider the problem of characterizing a multi-photon 
pair source with respect to a perfectly entangled qubit 
pair source by checking the measurement statistics of the 
actual source. This is in the spirit of the idea of self- 
testi ng quan tum apparatus first proposed by Mayers and 
Yao [29|, [30] ■ Along a similar line are device- independent 
QKD based on Bell's inequality l3lL 32j and state tomog- 
raphy based on Bell's inequality [33 1. 

To illustrate the applicability of our model to Bell's 
inequality testing, let us consider quantum state tomog- 
raphy based on Bell's inequality [331 ] . Bardyn et al. [33j 
have considered the problem of quantifying the closeness 
of an unknown entangled state emitted by a black box 
to ideal entangled states by simply testing the unknown 
state for its CHSH violation. For entanglement sources 
that emit qubit pairs, they showed that the fidelity F 
for characterizing the closeness to maximally entangled 
two-qubit states is bounded by 



F > (1 + VlXobs/2] 2 - l)/2 



VII. CONCLUSIONS 

The use of threshold detectors has been a major obsta- 
cle in bridging the practical experiments on quantum pro- 
tocols and their theoretical qubit-based analyses. In this 
paper, we provide a universal solution to this for a wide 
range of protocols including single-qubit-based schemes 
for QKD, quantum state tomography, and entanglement 
verification. This allows the translation of existing anal- 
yses that assume single-photon inputs to ones that can 
handle multiple-photon inputs detected with threshold 
detectors. For future work, it will be interesting to ex- 
plore the applicability of our universal squash model in 
other contexts such as quantum metrology }74j and linear 
optics quantum computation [75j . 
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(30) 



where x bs is the observed CHSH violation. Our result al- 
lows the application of Eq. (|3U|) even in situations where 
practical entanglement sources that may emit pairs of 
multi-photon signals and threshold detectors are used. 
In the end, we may regard the practical source as a two- 
qubit entangled source having certain fidelity to a maxi- 
mally entangled state. 

For the CHSH-inequality test, suppose that the num- 
ber of bits for bases Ai and Bj is iV^^., which can 

be decomposed as N^Bj = ^aJb- + ^a~ b . + N^.g. 
where N A \ B and N^ . B . are the single-click events corre- 
sponding to the ± 1 outcome of the measurement Ai ® Bj 
and double-click events, respectively. Then, E[AiBj] is 
bounded by 



AT 
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AiBj 



N At B, 



3 - < E[AiBj] 
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AiBa 



AiB, 



(31) 



and the CHSH violation x can be bounded by combining 
the corresponding bounds for the various E[AiBjYs: 



f + 

<E?i 



E 21 - E 22 < X 
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-^21 ~~ ^22- 



(32) 



Corollary 2. (CHSH-based source estimation) We re- 
gard the original entangled state processed by the squash 
operation A„_j.i on each side of the state in Situation 1 as 
the effective two-qubit state. We bound the CHSH viola- 
tion of the effective two-qubit state using Eqs. (| 3 II) - ([32]) 
and infer its fidelity with Eq. (j30[) . 



Appendix A: Proof of Theorem [TJ 

1. Statistical Equivalence of Situations 1 and 2 for 
projective measurements 

We show that the bit value outputs of Situations 1 and 
2 have the same statistics for any n-photon input state 
and any unitary transform. This result is non-trivial 
since it means that the quantum squash operation can be 
perfectly substituted by a classical operation. We show 
this by proving that (i) the squash operation commutes 
with the unitary transform and (ii) directly verifying that 
the statistics of a single-photon detection after squash is 
the same as the statistics of a multi-photon detection 
followed by our classical post-processor. 

For (i), it follows from the fact that the original state p 
lives in a tensor product space of n qubits and standard 
linear optics transformations act on each photon sepa- 
rately. Thus, when the transformation is characterized 
by a unitary transform U on one qubit, the transforma- 
tion on the n-qubit state is p' := U® n p{U^)® n . It can 
easily be checked that A n ^.i(p') = U A n -^.i(p)W . Here, 
W denotes the adjoint of U. 

For (ii), we consider whether the statistics of a single- 
photon detection after squashing p' is the same as the 
statistics of a PNR detection on p 1 followed by our clas- 
sical post-processor. We can verify this by comparing 
the probabilities of producing bits "0" and "1" in the 
two cases. In some sense this means that squash com- 
mutes with the final detection. Due to the bosonic sym- 
metry, the state p' is symmetric on exchange of the pho- 
tons (e.g., (001|p'|001) = (010|p'|010) = (100|p'|100) for 
a 3-photon state p'). In light of this symmetry, we de- 
note the probability of p 1 collapsing to |x) in a PNR 
detection as \ n -k,k '■= (xlp'lx) where x is an n-bit 
string containing n — k "0"s and k "l"s. For example, 
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(001|p'|001) = (010|//|010) = (100|p'|100) = A 2 ,i. Nor- 
malization gives J2k=o (fe)^n-fe.fe = !• 

We now consider the outcome probabilities in Situa- 
tion 2 where the detectors are PNR and their results are 
processed by a classical post-processor whose behaviour 
is defined in Fig. [3] In general, for an n-photon state, 



CP fn\n — k 

fc=0 v 7 



k=0 v 7 



-k,k- 



(Al) 



(A2) 



Next, we consider the outcome probabilities in Situ- 
ation 1 where a squash is followed by a single-photon 
detection. The probability of getting is 



P S Q = (oia^GoOIo). 



(A3) 



Expanding the partial trace of the squash operation with 
the assumption of tracing over qubits 2 to n, we get 

Po Q = E (0*a • • • inl/lOia • • • in) (A4) 

t2,...,t„=0,l 

n— 1 ✓ _ i\ 

Similarly, the probability of getting 1 is 
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It can be easily checked that p^ p = p^ and p± 
Pi® for all n. This means that the squash operation 
commutes with the final detection. Since (i) works for 
any arbitrary basis, this proves Theorem [TJ Note that 
here we only focus on projective measurements. However, 
Theorem Q] also holds for generalized measurements (see 
Subsection IA 21 next) . 

Had we used PNR detectors in practice (i.e., Situa- 
tion 2), we would apply Theorem[T]to argue that we had a 
quantum channel that emits a single qubit to be detected 
since the squash operation in Situation 1 in connection 
with the original multi-qubit channel can be regarded as 
an effective single-qubit channel. This means that it is 
valid to apply the result of any single-qubit-based analy- 
sis. However, when we use threshold detectors instead of 
PNR detectors, we have to make additional arguments, 
through Situations 3, 4, and 5, to justify the use of single- 
qubit-based analyses. 



2. Statistical equivalence of Situations 1 and 2 for 
generalized measurements 

We show that Theorem [1] also holds for generalized 
measurements by extending the proof of the previous 
Subsection I A 11 Suppose that the detection setup in Sit- 
uations 1 and 2 is a POVM {Mi,i = l,...,m} on a 



qubit instead of a simple projection onto {|0)(0|, |1)(1|}. 
The ith PNR detector in Situation 2 indicates the num- 
ber of clicks rii for the POVM element Mj. Due to the 
bosonic symmetry of the n-photon state p' (76j . we de- 
note the probability of collapsing it to (x\, . . . , x n ) in the 
PNR detection in Situation 2 as X ni ,...,n m '■= Tr(M Xl ® 
■■■(g) M Xn p') where x\, . . . , x n each contains a POVM 
element index [l,m] and there are rii number of them 
with index %. For example, Tr(Mi ® Mi ® M 2 ® M 3 p') = 
Tr(M 3 ®M 1 ®M 2 ®M 1 p') = A 2 ,i,i for a 3-element POVM 
(m = 3) and a 4-photon state (n = 4). Normalization 
gives 



E 

niH \-U m = n 

n\ ,...,n m >0 



)•*•)' L m 



*nu-,nm = L ( A7 ) 



We define the classical post-processor in Situation 2 
to output outcome i 6 [1, ...,m] with probability n,/n, 
when there are rii photons detected in the ith PNR de- 
tector. Thus, the probability of getting outcome i in 
Situation 2 is 



P? P = 



n 



E " )-A, • (AM 

ni ,. . .,n m >0 



II I 



We now turn to the probability of getting outcome i 
in Situation 1: 

pf Q =Tr{MiA n ^(p')). (A9) 
We arbitrarily choose to trace over photons 2 to n: 
A n _>i(//) =Tr 2l ..., n (p') 



Tr 2 



I],...,l a 

e[i,ml 



(A10) 



Thus, we have 

so. _ Ti(Mi <g> M S2 <g> ■ ■ ■ <g> M X J) (All) 



Pi 



x 2 ,...,x„ 
G[l,m] 



E ( l^m,. 

ni+ ... +nm= „_lV ni '---' n TO> 
ni . .,n m >0 



which can easily be verified to be equal to Eq. (|A8|) . That 
is pf p = Pi for i = 1, ... , m. 



Appendix B: Derivation for the six-state QKD 
protocol 



The constraints for the six-state protocol are 
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b 2 + b 3 
h + b 3 . 
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We first find bi as follows: 

key 



= key 

"X 



= kcy 



which, using Eq. ([5]), implies 

e-2(5 



2(1-5) 



< 62 < 



26 



2(l-6y 



(B4) 



(B5) 



The entropy term in the key rate expression in Eq. ([7]) 
can be broken down into a sum of a bit-error-correction 
term and a phasc-error-correction term: 



h (b , b 1} 62, 63) = H(Z) + H(X\Z) 



where 



H(Z) 
H(X\Z) 



M4 cy ) 

(i-4 e5 >2 



key 
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(B7) 



(B8) 



(B9) 



h 2 (x) = -x log x - (1 - x) log(l - x). (BIO) 



We can substitute b 3 = e 



key 



62 in Eq. (|B8|) and maxi- 



mize H(X\Z) over 62 given its range in Eq. (|B5|) for fixed 



a key 



and 



P key 



Without the constraint of Eq. (|B5jl (i.e., 
the BB84 case), the maximizing value is 62 = e^ y e^ y . 
For simplicity, we assume that 26 -^i e <C 1/2 so that the 
lower bound of 62 in Eq. (IB5|) is greater than the upper 
bound of e^ y e^ y . Since H(X\Z) is a concave function in 
&2, this lower bound of &2 is the maximizing value when 
taking into account the constraint of Eq. (|B5I) . Next, 



we choose the largest possible value for ep v in order to 



maximize H(X\Z). Thus, we arrive at Eqs. (j8|)- (fi"0 



Appendix C: Passive basis selection 

We only consider uniform basis detection here. This 
means that for a B-basis scheme, the initial received 
light path is split equally into B paths. A pas- 
sive detection setup consists of orthogonal projections 
in multiple bases (see Fig. [5]). We can regard that 
there is only one POVM measurement having many el- 
ements. In the case of passive BB84, the POVM is 
{3|0,>(0,| > ||l,)(l,| I ^|0 x >(0 a .|,§|l x >(l x |}. Due to Ap- 
pendix lA~2l the statistics of Situations 1 and 2 arc equiv- 
alent even in the passive-basis-selection case. This estab- 
lishes one link in the overall argument depicted in Fig. [3] 
The next step is to establish the other link — the relation 
between the statistics that are actually observed in Sit- 
uation 3 (or equivalcntly Situation 4) and the statistics 
of the ideal Situation 2. Unlike the activc-basis-sclcction 
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FIG. 6. Detection system used by Bob with passive basis 
selection among two bases, where a beamsplitter (BS) splits 
the incoming signal into two paths corresponding to the two 
bases, two sets of waveplates (WP1 and WP2) each select one 
of the bases, and a polarizing beamsplitter (PBS) splits the 
signal into two arms for detection by two threshold detectors 
(DO and Dl). Here, the incoming signal consists of three 
photons and one is (two are) collapsed in detector DO of the 
first basis (detector Dl of the second basis). 



case, the statistics of Situation 2 here have two parts: one 
for the error rates of the bit values, and one for the statis- 
tics of the basis values. Here, we separately consider the 
two. 

We argue that the statistics of basis values in Situa- 
tion 4 is the same as that of Situation 1 (or equivalcntly 
Situation 2), when we adopt a particular basis selection 
rule for multi-basis events. Thus, once a basis is selected 
with this rule, it only remains to consider the relation 
for the bit- value statistics. Fortunately, this second part 
is the same as that of the active-basis-selection case and 
we can reuse the previous argument to estimate the error 
rates with the test bits and discard the double-click key 
bits. 

Now we prove that the basis statistics of Situation 
4 with the basis selection rule is the same as the ba- 
sis statistics of Situation 1. Obviously, in Situation 1, 
the single photon emitted from the squash operation col- 
lapses in each of the B bases with probability 1/B. In 
Situation 4, we use the following basis selection rule: 

• When only one basis has detection, we choose this 
basis. 

• When b < B bases have detection, we choose one 
among these b bases with uniform probability 1/b. 

The main point is to show that a basis A chosen according 
to this rule occurs with probability 1/B, i.e., same as 
Situation 1. This probability for an n-photon input state 
is as follows: 



1 ( B — 1 N 

P(A) :=^^ — [ ^ ) Prjdctcction in b bases 



6=1 



including basis A} (CI) 
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where 



Pb := Pr{ detection in b bases including basis A} 



Here, Pb is defined in terms of a fixed set of b bases of 
which basis A is an element. The first term in Eq. (|C2[) 
represents the probability that each of the n photons col- 
lapses in any one basis of this set. Since this term also 
includes the events that the n photons collapse in less 
than b bases, we exclude these events in the second term. 



Rewriting Eq. (|C1|) as 

^>=EK»:i) ft+ 5 ft < c3 » 

b=l v 7 

and substituting the expression for Pb from Eq. (|C2[) , we 
get 

P(A) = I. (C4) 

This means that by adopting this basis selection rule, 
the basis statistics of Situation 1 is preserved. The ap- 
proach to deal with the bit-value statistics is the same 
as the active-basis-selection case and we can reuse that 
result to handle the double-click events and to estimate 
the error rates. 
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